Vulnerability · Published Apr 13, 2026 · Assigned by WPScan
CVE-2025-15441Form Maker < 1.15.38 - SQL Injection
Medium 6.8
In plain English
A medium-severity SQL injection in Form Maker by 10Web from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.3%top 80.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Form Maker by 10Web | 0 – before 1.15.38 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://wpscan.com/vulnerability/41f69b0a-4d17-4a6b-b803-ea1c370e3cc0/ exploit, vdb-entry, technical-description